CVE-2026-118422

The Stape Conversion Tracking WordPress plugin (versions before 2.3.11 ) is vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) . The root cause is a failure to validate the sub-path appended to its same-origin proxy's upstream endpoint. This allows unauthenticated vis...